1

How can you run a command (e.g. iftop or similar) that requires root privileges from a non-root user and without using SUDO in front?

Alternatively, how can you give root privileges to a user without becoming root?

Ideally, I want to run the iftop command in the following way:

[user@pc]$ iftop

And not like:

[user@pc]$ sudo iftop

[root@pc]$ iftop
3
  • 1
    What is the purpose ? Sounds like an XY-Problem. – pLumo Mar 25 '20 at 14:05
  • I cannot run my command as root nor with sudo. So I'm looking for alternatives – Adam Mar 25 '20 at 14:08
  • @Adam Why can't you do that? – Kusalananda Mar 25 '20 at 15:05
2

How can you run a command (e.g. iftop or similar) that requires root privileges from a non-root user and without using SUDO in front?

There are at least 2 methods you can use to allow non-root users use iftop but both of them require root access.

The safer method is to assign cap_net_raw capability to iftop binary:

sudo setcap cap_net_raw+ep "$(command -v iftop)"

The less safe method is to assign setuid root:

sudo chmod +s "$(command -v iftop)"

Alternatively, how can you give root privileges to a user without becoming root?

You can't.

8
  • If I add the root setuid, the iftop command will be run with the root user, right? The best solution for me would be to run a generic binary that requires root privileges but from a non-root user and without sudo. – Adam Mar 25 '20 at 14:41
  • @Adam this sounds like a very bad idea. – Panki Mar 25 '20 at 14:43
  • It is only for testing purposes, not for production. In any case, is it possible? – Adam Mar 25 '20 at 14:47
  • @Adam: yes, it will. The best solution for me would be to run a generic binary that requires root privileges but from a non-root user and without sudo. - why do you need that? If there is a binary you use very often and get tired always typing sudo first the safest way is to assign needed capabilities with setcap, you will not sudo any more. Remember it's a huge security risk to allow unprivileged users on the system to run binaries that should run as root. – Arkadiusz Drabczyk Mar 25 '20 at 14:49
  • @Adam: I hope you're at least doing that in a virtual machine or a container and that you're the only user of that system. If that's your situation, you're free to experiment. – Arkadiusz Drabczyk Mar 25 '20 at 14:50
0

That can be done using the set user id file attribute:

# chmod u+s /usr/bin/sleep
# sleep 1000&
# ps aux | grep -w sleep | grep -v grep
root   1234  0.0  0.0   ...  0:00 sleep 1000

THIS IS A BIG SECURITY RISK!

If you wish to run something as someone else (not root, as here), that is possible:

# chown pulse /usr/bin/sleep
# chmod u+s /usr/bin/sleep
# sleep 1000&
# ps aux | grep -w sleep | grep -v grep
pulse   1234  0.0  0.0   ...  0:00 sleep 1000

If you are not root you can allow someone else to run a command as you:

# id -nu
john
# ls -l a.out
-rwxr-x--- 1 john users   50923 Mar 25 10:17 a.out
# chmod go+rx,u+s a.out
# ls -l a.out
-rwsr-xr-x 1 john users   50923 Mar 25 10:17 a.out

(please note the "s" where the "x" was in "rwx...". That means the set user id flag is set)

Then, as jane:

# id -nu
jane
# ~john/a.out

That command a.out will be run as john.

4
  • First, it's /usr/bin/sleep. Second, how can you do that as non-root? – Arkadiusz Drabczyk Mar 25 '20 at 14:14
  • @ArkadiuszDrabczyk Thanks for pointing out the typo. I have corrected it and added an example as non-root. None of the involved users need to be root. Naturally, you need to set the flag as the person who is to be impersonated and on your own file. Otherwise there would be no security in Linux. – Ned64 Mar 25 '20 at 14:21
  • OP asked how can you give root privileges to a user without becoming root? . – Arkadiusz Drabczyk Mar 25 '20 at 14:23
  • @ArkadiuszDrabczyk Then the second part of my comment has the answer. – Ned64 Mar 25 '20 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.